The cloud is someone else's computers, rented by the second and driven by APIs. Learn the service models (IaaS/PaaS/SaaS), regions and availability zones, and the shared-responsibility model — AWS secures the cloud, you secure what you put in it. This framing shapes every later decision.
Build itDraw the shared-responsibility line for a web app on EC2 vs on Lambda. Who patches the OS in each case — and why does that matter?
✓ CheckpointDraw the shared responsibility line for one managed service, and name what you wrongly assumed AWS handles.
2
Compute: EC2 & Lambda
F2 · Beginner · 65 min
Compute is where code runs. Learn EC2 (virtual machines you manage), Lambda (functions you do not), and the spectrum between — instances, AMIs, instance types, and the serverless tradeoff. Choosing the right compute model is the first big architecture fork on AWS.
EC2 instances & AMIs
Instance types & sizing
Lambda functions
Servers vs serverless
Build itA spiky, event-driven workload runs on an always-on EC2 box. Argue for moving it to Lambda — and name one case where you would not.
✓ CheckpointJustify EC2 over Lambda for one workload and the reverse for another. The same answer for both means you have a default, not a reason.
3
Storage: S3, EBS & EFS
F3 · Beginner · 60 min
AWS has a storage type for every shape of data: S3 (object storage — the backbone of the cloud), EBS (block volumes for instances), and EFS (shared file systems). Learn durability, storage classes, and lifecycle policies. S3 alone underpins a huge fraction of the internet.
S3 object storage & classes
EBS block volumes
EFS shared files
Durability & lifecycle policies
Build itStore user uploads cheaply but keep hot files fast. Design the S3 storage classes + lifecycle rules that move cold data to Glacier.
✓ CheckpointPick an S3 storage class for real data and say what retrieval costs you when you are wrong.
Every AWS resource lives in a network you define. Learn the VPC — subnets (public/private), route tables, internet and NAT gateways, and security groups vs NACLs. Networking is the most common source of "why can this not reach that?" — master it early and save yourself pain.
VPC & subnets
Route tables & gateways
Security groups vs NACLs
Public vs private subnets
Build itPut a database in a private subnet but let it reach the internet for updates. Which gateway and rules make that work securely?
✓ CheckpointExplain the difference between a security group and a NACL in terms of statefulness, and which one bites you first.
IAM decides who can do what. Learn users, roles, policies, and the principle of least privilege — plus why roles (temporary credentials) beat long-lived keys. Misconfigured IAM is behind most cloud breaches; getting identity right is the foundation of cloud security.
Users, roles & policies
Least privilege
Roles vs access keys
Policy evaluation
Build itA Lambda needs to read one S3 bucket and nothing else. Write the least-privilege role — and explain why you never hard-code keys.
✓ CheckpointExplain why a role beats a long-lived access key, and what rotates in each case.
6
Databases: RDS & DynamoDB
F6 · Intermediate · 60 min
AWS runs your databases so you do not have to. Learn RDS (managed relational — Postgres, MySQL) and DynamoDB (managed NoSQL, single-digit-ms at any scale). Understand when each fits and the managed-service tradeoff: less control, far less operational burden.
RDS (managed SQL)
DynamoDB (managed NoSQL)
Read replicas & Multi-AZ
Managed vs self-run
Build itA shopping cart needs massive scale and simple key lookups; reporting needs joins. Pick DynamoDB vs RDS for each and justify it.
✓ CheckpointExplain when DynamoDB is the right choice and what query becomes impossible once you commit to its key design.
Serverless lets you ship logic without managing servers: Lambda for compute, API Gateway for HTTP, and event triggers gluing services together. Learn cold starts, concurrency, and event-driven patterns. Done well, serverless scales to zero and to millions with the same code.
Lambda + API Gateway
Event triggers
Cold starts & concurrency
Event-driven patterns
Build itBuild a REST endpoint with API Gateway + Lambda + DynamoDB — no servers. Where do cold starts hurt, and how do you mitigate them?
✓ CheckpointExplain what causes a cold start and which of your workloads genuinely cannot tolerate one.
2
Containers: ECS & EKS
T2 · Advanced · 70 min
When you need more control than Lambda, containers fill the gap. Learn ECS (AWS-native orchestration), EKS (managed Kubernetes), and Fargate (serverless containers — no nodes to manage). Understand the tradeoff between operational simplicity and portability.
ECS orchestration
EKS (managed Kubernetes)
Fargate (serverless containers)
ECS vs EKS tradeoffs
Build itA team wants Kubernetes without managing control planes or nodes. Which AWS combo gives them that — and what do they give up?
✓ CheckpointExplain what Fargate removes and what it costs you compared with managing the nodes.
Click-ops does not scale or reproduce. Declare your AWS infrastructure in code — CloudFormation (native) or Terraform (multi-cloud) — so it is versioned, reviewable, and repeatable. Learn stacks, state, and drift. On AWS, IaC is not optional at any real scale.
CloudFormation
Terraform on AWS
Stacks & state
Drift detection
Build itProvision a VPC + EC2 + security group as code. Someone edits it in the console — how does your next deploy detect and fix the drift?
✓ CheckpointExplain what drift is and why detecting it matters more than preventing every manual change.
4
Observability: CloudWatch
T4 · Advanced · 60 min
You cannot operate what you cannot see. Learn CloudWatch — metrics, logs, alarms, dashboards — plus X-Ray tracing across services. Instrumenting for the three pillars (metrics, logs, traces) is what turns a 3am outage from a guessing game into a guided fix.
CloudWatch metrics & logs
Alarms & dashboards
X-Ray tracing
The three pillars
Build itA serverless API is intermittently slow. Which CloudWatch metric alerts you, and how does an X-Ray trace pinpoint the slow downstream call?
✓ CheckpointExplain what a trace shows you that metrics and logs together still do not.
Decoupled systems talk through messages, not direct calls. Learn SQS (queues), SNS (pub/sub fan-out), and EventBridge (event bus with routing). These let services absorb bursts and fail independently — the backbone of resilient, event-driven AWS architectures.
SQS queues
SNS pub/sub
EventBridge routing
Async decoupling & DLQs
Build itAn order service must trigger email, inventory, and analytics without waiting on any of them. Wire SNS fan-out — and add a DLQ for failures.
✓ CheckpointJustify SQS over SNS for one integration, in terms of who needs the message and how many times.
Get content close to users and route them well. Learn CloudFront (CDN at the edge — caching, TLS termination) and Route 53 (DNS with health checks and latency/geo routing). Together they make a global app feel local and fail over gracefully across regions.
CloudFront edge caching
TLS termination
Route 53 DNS routing
Health checks & failover
Build itServe a global site fast and survive a regional outage. Put CloudFront at the edge and use Route 53 to route users to a healthy region.
✓ CheckpointExplain what CloudFront caches at the edge and what it cannot help with.
AWS distilled decades of hard lessons into six pillars: operational excellence, security, reliability, performance, cost, and sustainability. Learn to run a workload against them — it is the checklist that turns "it works" into "it works well, safely, and affordably."
The six pillars
Trade-off analysis
Well-Architected reviews
Design principles
Build itReview a simple architecture against the six pillars. Which pillar is it weakest on, and what one change improves it most?
✓ CheckpointName the weakest Well-Architected pillar in a system you know, and the pillar you traded away to strengthen it.
2
Security & Compliance
P2 · Advanced · 60 min
Security is job zero on the cloud. Learn encryption (at rest with KMS, in transit with TLS), secrets management, network isolation, and the guardrail services (GuardDuty, Config, CloudTrail) that audit and enforce. Defense in depth, not a single wall.
Encryption (KMS) & TLS
Secrets management
CloudTrail & Config
Defense in depth
Build itAn auditor asks "who accessed this bucket last month, and is it encrypted?" Which services answer both — and how do you prove it?
✓ CheckpointExplain what CloudTrail answers after an incident that CloudWatch does not.
3
High Availability & Multi-Region
P3 · Advanced · 65 min
Things fail; good architectures survive them. Learn Multi-AZ for zone failures, multi-region for regional disasters, and the RTO/RPO tradeoffs of active-passive vs active-active. Availability is designed in from the start, not bolted on after the first outage.
Multi-AZ vs multi-region
Active-passive vs active-active
RTO / RPO
Failover & backups
Build itYour app must survive an entire AWS region going down. Sketch a multi-region design and state its RTO — and what it costs you.
✓ CheckpointState an RTO and RPO you would commit to in writing, and say whether multi-AZ or multi-region is required to meet them.
4
Cost Optimization / FinOps
P4 · Advanced · 55 min
The cloud bill is a design output you own. Learn the pricing levers — on-demand vs reserved vs spot, right-sizing, autoscaling, and storage tiering — plus cost visibility tools. FinOps is the discipline of getting the same result for a fraction of the spend.
On-demand / reserved / spot
Right-sizing
Cost Explorer & budgets
Storage tiering
Build itA dev environment runs 24/7 but is used 8 hours a day. List three changes that cut its bill by more than half.
✓ CheckpointExplain when spot is appropriate and what your workload must tolerate to use it.
5
Auto-scaling & Load Balancing
P5 · Advanced · 55 min
Match capacity to demand automatically. Learn Elastic Load Balancing (ALB/NLB) to spread traffic and Auto Scaling groups to add/remove instances on metrics. Together they deliver the cloud's core promise: handle a traffic spike without paying for idle capacity off-peak.
ALB vs NLB
Auto Scaling groups
Scaling policies & metrics
Health checks
Build itTraffic 10x's at noon and drops at night. Configure an ALB + scaling policy that adds instances on CPU and removes them when quiet.
✓ CheckpointExplain which metric you would scale on and why CPU is so often the wrong one.
Ship changes safely and often. Learn the CI/CD toolchain (CodePipeline, CodeBuild, CodeDeploy), blue-green and canary deploys, and integrating IaC into the pipeline. The goal is boring, reversible releases — deploy on every merge without holding your breath.
CodePipeline / CodeBuild / CodeDeploy
Blue-green & canary
Pipeline + IaC
Rollbacks
Build itDesign a pipeline that builds, tests, and deploys to a canary before full rollout — and rolls back automatically if error rate spikes.
✓ CheckpointExplain what a canary tells you that a staging environment cannot.
The common questions before you start — how long it takes, whether to follow it in order, and how it stays current.
How long does this roadmap take?
It runs 18 stations across 3 tracks — roughly ~16h of focused learning, plus the time you spend actually building. It is self-paced, so most people work through it over a few weeks, an evening or a single station at a time.
Do I have to follow the stations in order?
The tracks are ordered so each station builds on the one before, and following them start to finish is the intended path. But every station also stands alone — if you already have the foundations, jump straight to the part you need.
Is it free?
Yes. The whole roadmap, and every handbook, lab, and challenge it links to, is free and open — no sign-up and no paywall.
How is the roadmap kept current?
It teaches the durable fundamentals of the role first, then the tooling and the AI-era shifts on top — so most of it stays relevant as individual tools churn, and it is revised as the role itself changes.
Who is this roadmap for?
Anyone stepping into or leveling up in the Cloud / AWS role — whether you are switching in, early-career, or a senior filling gaps. Start where you are; the ladder shows what is left.
Finished this one? 0 / 31 Roadmaps done
Explore the topic
See this alongside everything else on the same subject — handbooks, system designs, challenges and tools, in one place.